# Polymorphic Phishing Page at addresses.performs.vu Regenerates Its Code on Every Load, Defeating Hash-Based Detection

> SANS Internet Storm Center handler Jan Kopriva documented a live credential-phishing page at addresses.performs.vu that regenerates its HTML/JavaScript on every request, randomizing function/variable names, form fields, CSS classes, numeric constants, and hidden zero-width characters so that 50 sampled loads produced 50 distinct SHA-256 hashes. A coding flaw in the obfuscator itself (two decoding routines sharing the undeclared global variable k) trapped roughly 2 of 56 samples in an infinite loop, stalling the browser for ~30 seconds at 100% single-core CPU.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2183
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-self-breaking-polymorphic-phishing-tl-2026-2183.webp?v=28386dde (Threadlinqs threat intel: Polymorphic Phishing Page Hash Evasion: Detection & IOCs (TL-2026-2183) — Medium severity, 5 IOCs, 9 detection rules.)
- **ID:** TL-2026-2183
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 5 (1 shown free below)

## Description

On 2026-08-27, a SANS ISC handler received a phishing email containing a link of the form hxxps[:]//addresses.performs.vu/communications.html?good=[recipient_address] (the good= parameter carries the target's own email address for personalization). Visiting the link triggered a heavily obfuscated JavaScript decoding routine that took roughly 30 seconds to execute while pinning a single CPU core to 100%, before rendering an otherwise unremarkable credential-stealing page whose observed titles included 'Solution', 'Viewer', 'Credentials', 'Private', and 'Authenticate'.

To characterize the server, the handler retrieved the URL 50 times via an automated script (plus manual attempts, ~56 samples total). Every one of the 50 scripted samples produced a distinct SHA-256 hash of the served page, and 21 distinct page titles were observed across the set — the server rewrites JavaScript function and variable names, HTML form/input names, CSS classes, and element identifiers on every request, expresses numeric constants through different arithmetic operations each time, and inserts hidden zero-width characters into visible strings. Deobfuscating the samples showed the underlying page logic and final payload were functionally identical across variants; only the surface representation changed.

The obfuscator itself contains a bug: two JavaScript functions, an outer loop counter in _il() (intended range 0-64) and a Base64-alphabet helper _YF(), both rely on an undeclared (implicitly global) variable k. Repeated calls to _YF(47,47) reset k to 48 each time, and the outer loop's increment then advances it to 49 without ever breaking the cycle, producing an endless 48-to-49-to-48 loop. This flaw caused roughly 2 of 56 collected samples (about 3.6%) to hang indefinitely rather than render, meaning the anti-detection mechanism itself intermittently breaks the phishing page it protects.

The handler assessed that a conventional polymorphic JavaScript obfuscator, not an LLM-based code generator, most likely produced the variants, based on the systematic, mechanical nature of the transformations and the type of bug observed (a classic scoping error consistent with automated random renaming/reordering tooling) — contrasted against Unit 42's January 2026 proof-of-concept for LLM-generated, per-visit malicious JavaScript delivered through trusted AI-provider domains. No BeaconBeagle correlation, associated IPs, or additional infrastructure for addresses.performs.vu were found at analysis time; the domain sits on the .vu (Vanuatu) ccTLD, an extension increasingly abused for phishing due to minimal registration verification and default WHOIS privacy, as separately documented in unrelated .vu-hosted phishing campaigns (e.g., ioloo.vu) reported around the same period.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1598.003 Spearphishing Link
- T1608.005 Link Target
- T1583.001 Domains
- T1204.001 Malicious Link
- T1027 Obfuscated Files or Information
- T1027.014 Polymorphic Code
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1684.001 Impersonation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Phishing Link Click to addresses.performs.vu Polymorphic Credential Page — SPL** (`TL-2026-2183-SPL-001`)

Detects a proxy or email-gateway request for the live polymorphic credential-phishing page at addresses.performs.vu/communications.html, personalized via a good= query parameter carrying the target's own email address. Covers the initial-access spearphishing-link click and the recipient-targeting technique used to stage it.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1598.003, T1204.001
- **Data sources:** web_proxy, email_gateway, dns
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="web_proxy" earliest=-24h
| eval url_domain=lower(url_domain)
| where url_domain="addresses.performs.vu" OR match(url, "(?i)addresses\.performs\.vu\/communications\.html")
| rex field=url "good=(?<recipient_param>[^&\s]+)"
| table _time, src_ip, src_user, url, recipient_param, http_user_agent, http_referrer, action
| sort -_time
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "addresses.performs.vu" and RemoteUrl has "/communications.html"
| extend RecipientParam = extract(@"good=([^&\s]+)", 1, RemoteUrl)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RecipientParam, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Phishing Link Click to addresses.performs.vu Polymorphic Credential Page
id: 8f2a1c4e-6b3d-4e7a-9f21-3d5b7c9a1e02
status: experimental
description: Detects a proxy/web request to the known polymorphic credential-phishing domain addresses.performs.vu, path /communications.html, personalized via a good= recipient-email query parameter.
references:
  - https://isc.sans.edu/diary/33290
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.reconnaissance
  - attack.t1598.003
  - attack.execution
  - attack.t1204.001
logsource:
  category: proxy
  product: web
detection:
  selection_domain:
    c-uri-host|contains: 'addresses.performs.vu'
  selection_path:
    c-uri|contains:
      - '/communications.html'
      - 'good='
  condition: selection_domain and selection_path
falsepositives:
  - None expected; domain is not known for any legitimate use
level: high
```

**Known false positives:**

- Security-research or threat-intel automation retrieving the URL for analysis/sandboxing (as SANS ISC itself did via an automated script)
- Automated URL-reputation crawlers or secure-email-gateway link-detonation services following the link from a received email

**Tuning notes:** Scope url_domain/RemoteUrl matching to the exact registered domain addresses.performs.vu (and watch for near-neighbor typosquats on performs.vu) rather than a broad .vu wildcard here — the broader rare-TLD heuristic belongs on the infrastructure row (TL-2026-2183-*-003). Extract and alert on the good= parameter value to identify the targeted recipient without waiting for a help-desk report.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Phishing Link Click to [indicator] Polymorphic Credential Page — KQL (locked: unlock with TL Creds)
- Credential Submission or Browser CPU-Pin Anomaly on Polymorphic Phishing Page — KQL (locked: unlock with TL Creds)
- Sustained or Repeated Outbound Session to Rare .vu ccTLD Phishing Infrastructure — KQL (locked: unlock with TL Creds)
- Phishing Link Click to [indicator] Polymorphic Credential Page — Sigma (locked: unlock with TL Creds)
- Credential Submission or Browser CPU-Pin Anomaly on Polymorphic Phishing Page — Sigma (locked: unlock with TL Creds)
- Sustained or Repeated Outbound Session to Rare .vu ccTLD Phishing Infrastructure — Sigma (locked: unlock with TL Creds)
- Credential Submission or Browser CPU-Pin Anomaly on Polymorphic Phishing Page — SPL (locked: unlock with TL Creds)
- Sustained or Repeated Outbound Session to Rare .vu ccTLD Phishing Infrastructure — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 5)

Defanged, TLP:CLEAR.

- Domain: `addresses[.]performs[.]vu`

Full set of 5 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Make Phishing Pages Change Their Code Every Time Someone Opens Them](https://cybersecuritynews.com/hackers-make-phishing-pages/)
- [A polymorphic phishing page (that occasionally breaks itself)](https://isc.sans.edu/diary/33290)
- [A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th) mirror](https://www.ironcastle.net/a-polymorphic-phishing-page-that-occasionally-breaks-itself-thu-aug-27th/)
- [The Evolution of Phishing Kits](https://www.zscaler.com/blogs/security-research/evolution-phishing-kits)
- [The Tale of Double JavaScript Obfuscated Scam](https://www.akamai.com/blog/security/the-tale-of-double-javascript-obfuscated-scam)
- [Real-time Malicious JavaScript Through LLMs](https://unit42.paloaltonetworks.com/real-time-malicious-javascript-through-llms/)
- [Cloudflare Blocked the Page, But the Email Still Landed: A .vu TLD Phishing Domain That Slipped Through](https://ironscales.com/threat-intelligence/gmail-barracuda-relay-vu-tld-cloudflare-phishing-block-insurance-impersonation)
- [Academic paper on JavaScript/web-page obfuscation cited by the SANS ISC diary as related prior research](https://link.springer.com/chapter/10.1007/978-3-642-02617-1_28)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2183